Penetration Tester Skills

Question

What skills should I have to become a Penetration Tester?

Answer 1

Here are the technical skills we have seen employers favoring:

• Windows, UNIX and Linux operating systems
• C, C++, C#, Java, ASM, PHP, PERL
• Network servers and networking tools (e.g. Nessus, nmap, Burp, etc.)
• Computer hardware and software systems
• Web-based applications
• Security frameworks (e.g. ISO 27001/27002, NIST, HIPPA, SOX, etc.)
• Security tools and products (Fortify, AppScan, etc.)
• Vulnerability analysis and reverse engineering
• Metasploit framework
• Forensics tools
• Cryptography principles

To know more about it, it is recommended to take the Master's in CyberSecurity Program today.

Answer 2

A penetration tester should find vulnerabilities in an application. So he must have a good knowledge of all the possible vulnerabilities that an application can have and how to find and exploit it. Should be good with penetration testing tools and have creativity to use them in a customized way.

Answer 3

A Penetration tester should have following skills:

1. Expert knowledge of at least one mobile platform like iOS, Android etc

2. Expert application reverse engineering skill set, which can be applied to mobile platforms

3. In-depth understanding of mobile code (Objective C, Java, etc)

4. Strong knowledge of information security frameworks and standards such as ISO17799/27001 and their applications

5. Strong understanding of the security mechanisms associated with Windows or Unix operating systems, switched networks, web-based applications, and databases

6. Understand the security controls/processes required to implement a robust secure application and can clearly articulate the risk associated with the failure of those controls/processes

7. Strong web application testing experience

8. Keen understanding of network security architecture

9. Able to identify specific information security technical build guides and best practice deficiencies within the global organization; develop and drive cross-functional correction strategies

10. Able to identify security requirements for business applications and data